cleanup: comments in capabilities modules, default capabilities.toml, login

kernel/src/Sched/Consent.cpp

@@ -12,22 +12,7 @@
 #include <CppLib/Spinlock.hpp>
 
 // A process that lacks an eligible capability can ask the user for it the
-// first time a syscall needs it. The request goes to the session's consent
+// first time a syscall needs it.
-// agent (the desktop, which holds CAP_COMPOSITOR), which answers from its
-// stored decisions or by showing a prompt.
-//
-// This keeps both capability invariants:
-//  1. Authority only narrows down the process tree. A grant is bounded by the
-//     process's consent ceiling -- what its parent could have delegated to it
-//     at spawn -- and by the agent's own delegable set, and is only ever added
-//     to the effective set. Consent defers a delegation; it never exceeds one.
-//  2. Capabilities are kernel-owned. The kernel identifies the program by the
-//     path it loaded, never by a user name, and tells the agent whether that
-//     path is protected by CAP_SYSTEM_IMAGE (only then may it be remembered).
-//
-// Lock order: g_lock, then the scheduler lock (inside the Sched helpers).
-// Nothing takes g_lock while holding the scheduler lock; the wait predicate
-// that runs under the scheduler lock only reads atomics.
 
 namespace Sched::Consent {
 

programs/data/config/capabilities.toml

@@ -5,16 +5,6 @@
 # storage_admin, raw_storage, network_admin, set_time, user_admin,
 # display_admin, device_admin, log_read, system_image, compositor and "all".
 #
-# `effective` is what the program itself may use; `delegable` is what it may
-# pass on to programs it launches. The two are independent, and both are
-# clamped by the kernel to what the launcher can delegate.
-#
-# A grant only applies to a program under 0:/os or 0:/apps. Anything else can
-# be replaced by any process, so the kernel starts it with no capabilities.
-#
-# A program with no grant here can still ask for storage_admin, network_admin,
-# set_time, display_admin or log_read the first time it needs one: the desktop
-# prompts, and the answer is stored in 0:/config/consent.toml (docs/consent.md).
 
 # ==== System services (started by init) ====
 

programs/src/login/login_input.cpp

@@ -45,19 +45,9 @@ void build_console_args(LoginState* ls, char* out, int cap) {
 }
 
 void launch_session(LoginState* ls) {
-    // Authentication already succeeded and the session is set, so the password
-    // is no longer needed. Wipe it before the session runs rather than waiting
-    // for finish_desktop_session, so it does not sit in the heap for the whole
-    // session.
     montauk::memset(ls->password, 0, sizeof(ls->password));
     ls->password_len = 0;
 
-    // A session may pass on what it holds and no more. Authority is never
-    // propagated implicitly by spawn(): the desktop and the console both
-    // consult 0:/config/capabilities.toml to decide which program receives
-    // which subset, and the kernel clamps that to this set.  A standard
-    // session is delegable for the same reason an admin one is -- otherwise
-    // its own terminal could not hand the shell the suspend it already has.
     montauk::abi::SpawnCapabilities caps{};
     caps.effective = montauk::user::is_admin(ls->username)
         ? montauk::abi::CAP_ADMIN_SESSION

programs/src/login/main.cpp

@@ -113,10 +113,6 @@ extern "C" void _start() {
         while (montauk::is_key_available()) {
             montauk::abi::KeyEvent key;
             montauk::getkey(&key);
-            // Deliberately untranslated: the login screen is US-English only
-            // until it grows its own layout switcher. There is no user yet, so
-            // there is no per-user layout to apply, and silently picking one
-            // would leave no way to type a password in a different layout.
             handle_key(ls, key);
             key_changed = true;
         }
@@ -128,16 +124,6 @@ extern "C" void _start() {
             first_frame = false;
         }
 
-        // Event-driven wait: input_wait returns the instant the mouse or
-        // keyboard ISR reports activity, so the cursor tracks the device with
-        // no fixed-timer latency. timeoutMs is only an upper bound. Matches
-        // the desktop's run loop; a plain sleep_ms() here cannot wake early
-        // and makes every gesture start ~16 ms late.
-        //
-        // The login screen has no periodic UI (no clock, no caret blink, no
-        // animation), so when idle it never needs to wake without input: pass
-        // UINT64_MAX to block indefinitely and consume 0% CPU until the next
-        // mouse/keyboard event, instead of waking ~62x/sec for nothing.
         uint64_t wait_ms = fast_mouse_path ? 1
                          : ((mouse_changed || key_changed) ? 4 : UINT64_MAX);
         input_serial = montauk::input_wait(input_serial, wait_ms);